Hi Managers,
My thanks to all who replied to my original query:
> Could someone tell me the most likely reason for the following message
> to appear in /var/adm/messages? I've never seen the like.
> seawall unix: IP: Hardware address '08:00:20:23:51:48' trying to be our
> address 159.017.005.083!
The overwhelming consensus was that there was a system on our network
which had appropriated "seawall's" IP address and that ARP was reporting the
alert to /var/adm/messages.
I initially thought the same thing, that a PC or somesuch had been attached to
the network using seawall's IP address. However, the ethernet address being
reported was in-fact seawall's address. The problem has not reappeared since
the original event(s).
At any rate, for diagnosing problems of this sort, a few respondents had
some advice to offer in trouble shooting:
>From Steve Phelps <steve@epic.co.uk>:
> To check whether this is in fact caused by duplicate IP try the
> following test:
>
> ifconfig 159.17.5.XX
>
> where XX is an address definately NOT used.
>
> If errors go away then it is almost certainly caused by duplicate IP.
Another suggestion from Steve was to dump the ARP tables (arp -a) to get
the current MAC->IP translations that the server knows about.
>From Ray <rtrzaska@uk.mdis.com> comes first hand experience in this situation
where the problem turned out to be a faulty cabletron hub port. He recommends
checking hub port, cabling and patch revisions.
>From Perry Hutchison <perryh@pluto.rain.com>, a more arcane suggestion:
> More far-fetched, maybe some router is trying to proxy-arp for it but
> on its own network (which is a no-no), however this should not cause it
> to report its own Ethernet address as the source of the bogus broadcast.
>From Adam Nevins <adam@ltx.com> and Aggelos P. Varvitsiotis
<avarvit@cc.ece.ntua.gr> comes the reccomendation to use "snoop" or
"etherfind" to ferret out the culprit machine.
Again, my thanks to all who responded:
<steve@epic.co.uk>
<tswong%nisplus@[192.9.201.3]>
<rtrzaska@uk.mdis.com>
<kpi@hobbes.crc.com>
<s.barbaresi@bangor.ac.uk>
<bismark@lata.jpl.nasa.gov>
<perryh@pluto.rain.com>
<avarvit@cc.ece.ntua.gr>
<cbarnard@cs.uchicago.edu>
<mrs@cadem.mc.xerox.com>
<adam@ltx.com>
--
John S. Mclaughlin | "Can you tell me please, which way
Citibank Delaware | to go from here?" asked Alice.
(302) 324-6491 | "That depends a good deal on where
john.mclaughlin@citicorp.com | You want to go," said the Queen.
This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:10:55 CDT